CLAIMS 
What is claimed is: 

1 . A method of protecting and executing executable files, the method comprising: 
protecting an executable file through either of compression and encryption; 
incorporating a protection descriptor into said executable file, said protection 

descriptor including information required for unprotecting said executable file; 

providing said protected executable file to unprotection and execution apparatus 
operative to unprotect said executable file; 

unprotecting said protected executable file at said unprotection and execution 
apparatus using said protection descriptor; and 

executing said unprotected executable file at said unprotection and execution 

apparatus. 

2, A method according to claim 1 wherein said incorporating step comprises including 
either of a compression key and an encryption key required to uncompress or decrypt said 
protected executable file in said protection descriptor. 

3 * A method according to claim 1 and further comprising encrypting said protection 

descriptor. 

4. A method according to claim 1 wherein said providing step comprises providing said 

protected executable fiJe to an interpreter. 
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cording 



5. A method according to claim 4 wherein said executable file is an ELF executable file 

and wherein said interpreter is an ELF interpreter. 



6 A method according to claim 4 wherein said unprotecting step further comprises 

checking said protected executable file for the presence of non-standard program code and 
unprotecting said protected executable file only when said non-standard program code is present 
in said protected executable file. 



7. A method according to claim 1 wherein said providing step comprises providing said 
protected executable file to a kernel module. 

8. A method of protecting and executing executable files, the method comprising: 
protecting at least one function within an executable file through either of 

compression and encryption, thereby creating a protected portion corresponding to said at least 
one function; 

preceding said protected portion with a function call instruction to a dynamic 
unprotector; 

executing said function call instruction, thereby executing said dynamic unprotector; 
unprotecting, at said dynamic unprotector, said protected portion, thereby creating an 
unprotected portion; 

overwriting said function call instruction and said protected portion with said 
unprotected portion; and 

executing said unprotected portion. 
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ccoraing to claim 8 and further comprising 



9- A method according to claim 8 and further comprising incorporating into said 

executable file a list identifying said protected function, said list describing any of the function 
length of said function, the compression method used to protect said function, the encryption 
method used to protect said function, and a key required to unprotect said protected portion, 
wherein said unprotecting step comprises unprotecting using any information in said list. 

10, A method according to claim 8 and further comprising providing said executable file 

to unprotection and execution apparatus, and wherein said executing, unprotecting, and 
overwriting steps are performed by said unprotection and execution apparatus. 

11- A method according to claim 10 wherein said protecting step comprises protecting 

said at least one function within an executable file, and wherein said providing step comprises 
providing said executable file to an interpreter. 

12. A method according to claim 1 1 wherein said executable file is an ELF executable file 
and wherein said interpreter is an ELF interpreter. 

13. A method of protecting and executing executable files, the method comprising: 
hashing at least one static portion of an executable file, thereby creating a 

cryptographic digest; 

encrypting, using said cryptographic digest, at least one execution parameter 
necessary for the execution of said executable file; 

storing said encrypted execution parameter in said executable file; 
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m^tst one static portion of said execut^^i 



hashing said atieast one static portion of said executable file, thereby recreating said 
cryptographic digest; 

decrypting, using said cryptographic digest, said at least one encrypted execution 
parameter; anH 

executing said executable file using said decrypted execution parameter. 

14. A method according to claim 13 wherein said encrypting step comprises encrypting 
the address of an instruction that represents the entry point for execution of said executable file. 

15. A method according to claim 13 wherein said first hashing, encrypting, and storing 
steps are performed on a first computer, and wherein said second hashing, decrypting, and 
executing steps are performed on a second computer. 

16. A method according to claim 13 and further comprising providing said executable file 
to unprotection and execution apparatus, and wherein said first hashing, encrypting, and storing 
steps are performed by said unprotection and execution apparatus. 

17. A method according to claim 16 wherein said first hashing, encrypting, and storing 
steps are performed on an executable file, and wherein said providing step comprises providing 
said executable file to an interpreter. 

18. A method according to claim 17 wherein said executable file is an ELF executable file 
and wherein said interpreter is an ELF interpreter. 
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